CVE-2025-38456: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user()
In the Linux kernel, the following vulnerability has been resolved:
ipmi:msghandler: Fix potential memory corruption in ipmicreateuser()
The "intf" list iterator is an invalid pointer if the correct "intf->intfnum" is not found. Calling atomicdec(&intf->nrusers) on and invalid pointer will lead to memory corruption.
We don't really need to call atomicdec() if we haven't called atomicaddreturn() so update the if (intf->inshutdown) path as well.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38456?
CVE-2025-38456 has not been assigned a common vulnerability scoring system (CVSS) score, but it is considered a medium severity due to potential memory corruption issues.
How do I fix CVE-2025-38456?
To fix CVE-2025-38456, update to the latest stable version of the Linux kernel that includes the patch for this vulnerability.
What impact does CVE-2025-38456 have on system security?
CVE-2025-38456 can potentially lead to memory corruption, which may facilitate unauthorized access or instability in the affected Linux kernel.
Which versions of the Linux kernel are affected by CVE-2025-38456?
CVE-2025-38456 affects multiple versions of the Linux kernel prior to the application of the relevant security patches.
Is there an exploit available for CVE-2025-38456?
As of now, there are no known public exploits specifically targeting CVE-2025-38456, but the vulnerability could be leveraged in targeted attacks.